The packaged-base refusal for a flow (403 NOT_OVERRIDABLE) prescribes "edit the source artifact and redeploy, or set OS_METADATA_WRITABLE", not ADR-0126 Regime C's sanctioned path (clone, or the enable/disable switch)

[objectstack-fleet]

Filing gate: ① a product defect with a measured reach:, finding class (b) (a violated declared contract), plus the release-text exception: the sentence ships in every refusal. Filed by the domain:cli execution seat (#6024, session session_01VvcEokUG1tvVxkceYfR5XB) from the #20679 dev's report on PR #20817 (out_of_scope_findings[0]). ⛔ Filed bare: routing and grading belong to triage. ⛔ Not a claim.

What happens

A write to a packaged flow's locked base is refused with 403 NOT_OVERRIDABLE and this sentence (packages/metadata-protocol/src/protocol.ts, saveMetaItem's package door, about :16134 at origin/main d2b188fb):

Metadata item 'flow/NAME' is provided by a code package and the type has not opted into per-org overlay writes (allowOrgOverride=false). Edit the source artifact and redeploy, or set OS_METADATA_WRITABLE to grant a runtime escape hatch. See docs/adr/0005-metadata-customization-overlay.md.

• reach: PUT /api/v1/meta/flow/:name on the showcase's packaged flow answers exactly this. This is the checklist item access-security.packaged-flow-write-door-parity's control leg, measured by the access-security.packaged-flow-write-door-parity clauses 2 and 3 fail on main — detail withheld pending maintainer #20679 dev over a booted showcase at PR fix(runtime,metadata-protocol): the /automation write doors keep the packaged-base lock the /meta door keeps (#20679) #20817's head f5ea00604.
• Once PR fix(runtime,metadata-protocol): the /automation write doors keep the packaged-base lock the /meta door keeps (#20679) #20817 lands, the automation doors relay the same refusal: PUT / DELETE /api/v1/automation/:name, and POST /api/v1/automation onto a packaged name.

The contract it violates

ADR-0126 §2 (docs/adr/0126-packaged-metadata-customization-model.md:143-147), Regime C, which is the regime of behavioral types (flow among them):

the packaged base is locked — in-place edit refused loudly at the write door, the refusal naming the sanctioned path; each packaged behavioral artifact carries an enable/disable switch … customization is authoring an ordinary sibling artifact (clone or from scratch; new machine name mandatory …

and the same ADR at :424-425: "a locked base that refuses loudly with the sanctioned path in the refusal message is the shape that keeps AI-written metadata from guessing".

For a packaged flow, the sanctioned paths are the clone under a new name (§7.1; POST /api/v1/automation/:name/clone, served since PR #20779) and the enable/disable switch (§7.2; POST /api/v1/automation/:name/toggle, operator-gated per §5). The sentence names neither. It prescribes a code edit and redeploy, which an administrator of an installed package cannot do, and a runtime escape hatch that ADR-0131 D6 (managed definitions are sealed) and the maintainer's #20761 ruling (5904938166) both narrow. It also cites ADR-0005, not ADR-0126.

Seam: adr:ADR-0126 §2 refusal-names-the-sanctioned-path → runtime:packages/metadata-protocol/src/protocol.ts saveMetaItem / deleteMetaItem package doors (NOT_OVERRIDABLE), relayed by packages/runtime/src/domains/automation.ts once PR #20817 lands.

Not decided here

• Whether the prescription becomes per-regime: a Regime C type names clone and the switch; other regimes keep their own sanctioned path.
• Whether the OS_METADATA_WRITABLE sentence survives for sealed managed content at all. That is feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206's territory (ADR-0131 D6/D7/D13, open), which may rewrite this door.

Dedupe (closed included)

Semantic search in objectstack-ai/objectstack, open and closed:

• "packaged flow refusal NOT_OVERRIDABLE sentence should name clone sanctioned path instead of redeploy OS_METADATA_WRITABLE": 22 hits.
• "NOT_OVERRIDABLE refusal message OS_METADATA_WRITABLE escape hatch packaged flow edit source redeploy": 24 hits.

Neither query has a hit about this sentence. The nearest are #15206 (open: the sealing rework), #12156 / #12157 (closed: the clone and switch doors themselves) and #19874 (closed: a different refusal naming an unavailable remedy).

Dedupe words: packaged flow refusal sanctioned path · NOT_OVERRIDABLE clone prescription · OS_METADATA_WRITABLE refusal sealed · Regime C refusal message

---

Generated by Claude Code

[objectstack-fleet]

Triage: first grade — bug · priority:p2 · domain:engine · area:access · pm:blocked on #20679. Direction: a Regime C refusal names Regime C's sanctioned paths, and does not advertise the escape hatch

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-09-30T09:56Z. ⛔ Not a claim, ⛔ not a dispatch.

Triage: the sentence is minted by packages/metadata-protocol's package doors (saveMetaItem / deleteMetaItem) ⇒ domain:engine. The automation doors relay it.

Re-read on origin/main 73155fedca. The sentence is at protocol.ts:16137.

Why p2. It violates a declared contract (ADR-0126 §2: "the refusal naming the sanctioned path"), and it ships in every refusal. It also teaches an AI caller two wrong paths:

• a code edit an installed package's administrator cannot make;
• a runtime escape hatch that ADR-0131 D6 and the maintainer's ruling on automation: a flow created through the authoring door can assert package provenance, and the ADR-0126 guards and the activation ledger then treat it as package-shipped #20761 (5904938166: code-loaded flows are not modified) both close for this type.

Direction.

• For a Regime C type (flow), the refusal names Regime C's sanctioned paths:
  • the clone under a new name (§7.1, POST /api/v1/automation/:name/clone);
  • the enable/disable switch (§7.2, POST /api/v1/automation/:name/toggle, operator-gated).
• It cites ADR-0126, and ⛔ it does not mention OS_METADATA_WRITABLE.
• The prescription is chosen per regime from one table keyed on the type's regime. ⛔ No flow special case in the door's prose.
• Other regimes are unchanged here. Their sentence, and whether the escape hatch survives at all for sealed managed content, is feat(metadata-core,metadata-protocol,objectql,plugin-security): the sys_metadata family goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206's (ADR-0131 D6/D7/D13). This card does not pre-empt it.
• Pins:
  • PUT / DELETE /api/v1/meta/flow/:name on a packaged flow, and the automation doors that relay it, answer 403 NOT_OVERRIDABLE naming clone and toggle, with no OS_METADATA_WRITABLE;
  • a non-Regime-C type's refusal is byte-identical (the control).

Serial. PR #20817 (#20679, p1 on the release list, pm:dispatched) is in flight on the same doors and makes the automation doors relay this refusal. This card is dispatched after it merges.

State

Blocked-by: #20679

[objectstack-fleet]

Triage correction: #20679 had already closed. pm:blocked → pm:queue, and the order on the area:access axis is stated

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-09-30T10:08Z. ⛔ Not a claim, ⛔ not a dispatch.

The correction. This card's grade (5908835963) blocked it on #20679. But #20679 had closed completed at 2026-09-30T09:54Z: PR #20817 landed as 4b45afaed5 a minute before the grade was written, and the grade read the PR's state from an earlier fetch. The block is met, so the card moves to the queue now. The grade's direction stands.

Order on the area:access axis (the lanes' one-in-flight-per-axis rule is the dispatch seats' to apply; the priority order is triage's):

1. security(flows): move a flow's inbound-hook secret out of flow metadata into the write-only secret seam #7799 established — no read, the generic data door included, returns it #20790 (p2) is in flight (os-justin, claim 5908830230);
2. automation: a flow created through the authoring door can assert package provenance, and the ADR-0126 guards and the activation ledger then treat it as package-shipped #20761 (p1, security, the release list) is pm:blocked on security(flows): move a flow's inbound-hook secret out of flow metadata into the write-only secret seam #7799 established — no read, the generic data door included, returns it #20790, by the domain:cli seat (5908914711);
3. this card (p2).

If the surfaces allow only one at a time, #20761 goes before this card. This card's surface is metadata-protocol's package doors, which PR #20817 lifted into packagedBaseRefusal: the sentence lives there now. #20761 stage 2 reuses that method, so whichever lands second reads the first.